Privacy
Last change: 13 November 2026
This page tells you what data Supapoint keeps about you, why, and what you can do about it. Supapoint ("we") runs the service from the Philippines and is the personal information controller under the Data Privacy Act of 2012 (Republic Act 10173).
What we keep
| Data | Why |
|---|---|
| Your email address and password hash | To make and protect your account. We never see your password. |
| Your Google or Discord link, if you add one (the email, name, and picture that the provider gives) | To let you sign in with that provider. |
| Your access, role, license, and plan | To decide what you can download and use. |
| Each computer that signs in to the app: the name you give it, the platform, the app version, a public key, a hash of the machine id, the country, and dates | To limit how many computers use one license, and to let you remove a computer. |
| App sessions: dates, the app version, and a hash of the app file | To keep you signed in, to end sessions, and to find changed or cracked copies. |
| Downloads and update checks: which build, the country, and the date | To run the alpha and to see which builds people use. |
| Security events: for example a reused sign-in token or too many new computers, with the country and the date | To protect your account and the service from abuse. |
We do not keep your IP address in our own database. Our providers handle it for a short time to deliver the service, stop bots, and limit abuse. Supabase Auth keeps sign-in logs with IP addresses for security.
We do not sell your data. We do not use advertising or tracking. We do not use analytics cookies.
Cookies
The site sets only the cookies that sign-in needs. They hold your session and expire when you sign out or after a period with no use. Cloudflare Turnstile, the check that you are a person, can set its own short-lived data to do that check.
Who processes the data for us
- Supabase: the account and license database and sign-in. Region: Singapore.
- Cloudflare: the website, the API, the storage for builds, Turnstile, and email forwarding.
- Google and Discord: only if you sign in with them.
Some of these providers process data outside the Philippines. They protect it under their own data processing terms.
How long we keep it
We keep your account data while your account exists. When you ask us to delete your account, we delete your profile, license, computers, and sessions. Download, security, and admin logs stay as security records, without the link to your account.
Your rights
Under the Data Privacy Act you can ask to see your data, correct it, delete it, get a copy, or object to its use. Write to security@supapoint.live. We answer within 30 days. You can also complain to the National Privacy Commission (privacy.gov.ph).
Security
All traffic uses TLS. Tokens and invite links are stored as hashes only. To report a security problem, write to security@supapoint.live or see security.txt.
Age
Supapoint is for people who are 18 or older, or who have the permission of a parent or guardian.
Changes
When this page changes, the date at the top changes. For a large change, we tell members by email first.